Databases where PHI is placed, processed and stored that are used as resources for future research require a HIPAA Research Authorization or a HIPAA Waiver. Since the definition of Research is the same under HIPAA and the Common Rule, these databases also require IRB approval. Complete a Form 7 when requesting a HIPAA Authorization or a HIPAA Waiver.
This form is used to help you fulfill HIPAA accounting requirements when you are granted a research authorization waiver. I f you access 50 or fewer records, you must record the names of the records you have accessed. If you access 51 or more records, you may create a profile of the study population (e.g., men over age 70 with glaucoma and a history of hypertension). In either case, it is the responsibility of the PI to report the names or profile to his/her institution’s HIPAA Privacy Officer for Research.
The Tufts Medical Center/TUHS IRB/Privacy Board may permit the use and disclosure of PHI as a Limited Data Set under a Data Use Agreement between a Data User and Tufts Medical Center/TUHS. The PI should complete the Data Use Agreement Form to ensure that the request for Limited Data Set under a Data Use Agreement includes all of the necessary information regarding the uses and disclosures. The following elements should be included in the agreement:
1. Establish the permitted uses and disclosures of the limited data set by the recipient, consistent with the purposes of the research.
2. Limits on who can use or receive the data
3. Requires appropriate safeguards to prevent the use or disclosure of the information other than as provided for in the data use agreement
4. Requires reporting of unauthorized uses or disclosures to the HIPAA Privacy Officer. This information should also be reported to the IRB.
5. Prohibits contacting subjects or identifying information of subjects
This form is required when you plan to access PHI for purposes preparatory to research (such as preparing a research protocol, assessing feasibility of a research study, developing a hypothesis, or identifying prospective participants who would meet eligibility criteria for a proposed project). The PI will confirm the following on the Review Preparatory to Research Form:
1. The use of the PHI is solely for purposes preparatory to research.
2. The review is necessary for preparation.
3. No PHI is removed from the covered entity during the course of the review.
This form is for use when a case report may directly or indirectly identify a patient. An analysis of more than 3 clinical cases meets the definition of research that must receive IRB approval before starting. These cases also require HIPAA authorization from the patient. Please refer to the case report policy for more information.